Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
SAP NetWeaver Enterprise Portal Administration
Insecure deserialization with an RCE outcome on the portal server is serious. Note that this requires privileged access to exploit — it is not an unauthenticated attack. That said, if you have multiple portal admins or shared admin credentials, the blast radius is significant. If you run NetWeaver Enterprise Portal, this is a same-window patch.
Vulnerability Detail
Privileged users can upload malicious serialized objects through the Enterprise Portal Administration interface. When the server deserializes these objects, arbitrary code executes in the context of the portal server process, compromising confidentiality, integrity, and availability of the system.
Workaround
Restrict access to Enterprise Portal Administration to only trusted administrator accounts. Monitor upload activity in portal admin interfaces.
Patch Action
Apply SAP Note 3714585.
Affected Versions
Patch Info